1

Investigating self-similarity and heavy-taileddistributions on a large scale experimental facility

Patrick Loiseau, Paulo Goncalves,Member, IEEE,Guillaume Dewaele, Pierre Borgnat,Member, IEEE,PatriceAbry, Senior Member, IEEE,and Pascale Vicat-Blanc Primet,Member, IEEE

Abstract—After the seminal work by Taqqu et al. relating self-similarity to heavy-tailed distributions, a number of researcharticles verified that aggregated Internet traffic time series showself-similarity and that Internet attributes, like Web file sizesand flow lengths, were heavy-tailed. However, the validation ofthe theoretical prediction relating self-similarity and heavy tailsremains unsatisfactorily addressed, being investigated either us-ing numerical or network simulations, or from uncontrolled Webtraffic data. Notably, this prediction has never been conclusivelyverified on real networks using controlled and stationary scenarii,prescribing specific heavy-tailed distributions, and estimatingconfidence intervals. With this goal in mind, we use the potentialand facilities offered by the large-scale, deeply reconfigurableand fully controllable experimental Grid5000 instrument, toinvestigate the prediction observability on real networks. To thisend we organize a large number of controlled traffic circulationsessions on a nation-wide real network involving two hundredindependent hosts. We use a FPGA-based measurement system,to collect the corresponding traffic at packet level. We thenestimate both the self-similarity exponent of the aggregatedtime series and the heavy-tail index of flow size distributions,independently. On the one hand, our results complement andvalidate with a striking accuracy some conclusions drawn froma series of pioneer studies. On the other hand, they bring in newinsights on the controversial role of certain components ofrealnetworks.

I. M OTIVATIONS

Comprehension and prediction of network traffic is a con-stant and central preoccupation for Internet Service Providers.Challenging questions, such as the optimization of networkresource utilization that respect the application constraints,the detection (and ideally the anticipation) of anomalies andcongestion, contribute to guarantee a better quality of ser-vice (QoS) to users. From a statistical viewpoint, this is achallenging and arduous problem that encompasses severalcomponents: network design, control mechanims, transportprotocols and the nature of traffic itself. In the last decade,great attention has been devoted to the statistical study oftime

Patrick Loiseau is with Universite de Lyon,Ecole Normale Superieurede Lyon (LIP), 46 allee d’Italie, 69364 Lyon cedex 07, France. (e-mail:Patrick.Loiseau@ens-lyon.fr)

Paulo Goncalves and Pascale Vicat-Blanc Primet are with INRIA, Uni-versite de Lyon, Ecole Normale Superieure de Lyon (LIP), 46 alleed’Italie, 69364 Lyon cedex 07, France. (e-mails: Paulo.Goncalves@ens-lyon.fr, Pascale.Primet@ens-lyon.fr)

Guillaume Dewaele is with Universite de Lyon,Ecole Normale Superieurede Lyon, Laboratoire de Physique, 46 allee d’Italie, 69364Lyon cedex 07,France. (e-mail: Guillaume.Dewaele@ens-lyon.fr)

Pierre Borgnat and Patrice Abry are with CNRS, UMR 5672, Universite deLyon, Laboratoire de Physique,Ecole Normale Superieure de Lyon, 46 alleed’Italie, 69364 Lyon cedex 07, France. (e-mails: Pierre.Borgnat@ens-lyon.fr,Patrice.Abry@ens-lyon.fr)

series and random variables, which collected at the core ofnetworks, are valuable fingerprints of the system state and ofits evolution. With this in mind, the pioneering work by [1]and [2] evidenced that the Poisson hypothesis, a relevant andbroadly used model for phone networks, failed at describingcomputer network traffic. Instead, self-similarity was showna much more appropriate paradigm, and since then, manyauthors have reported its existence in a wide variety of traffics[3], [4], [5], [6]. Following up this prominent discovery,the theoretical work by Taqqu and collaborators constitutedanother major breakthrough in computer network traffic mod-eling, identifying a plausible origin of self-similarity in traffictime series [2], [7], [8]. It posits that the heavy-tail natureof some probability distributions, mainly that of flow sizedistributions, suffice to generate traffic exhibiting long rangedependence, a particular manifestation of self-similarity [9].To support their claim, they established a close form relationconnecting the heavy-tail thickness (as measured by a tailindex) and the self-similarity exponent.

Notwithstanding its mathematical soundness, pragmatic va-lidity of this model has been corroborated with real worldtraffic data only partially, so far. The first pitfall lies inthe definition of long range dependence itself, which, aswe will see, is a scale invariance property that holds onlyasymptotically for long observation durations. Its consistentmeasurement requires that experimental conditions maintainconstant, and that no external activity perturbs the trafficcharacteristics. In those conditions, finding a scale rangethatlimits itself to stationary data, and that is sufficiently wide toendorse reliable self-similarity measurements, is an intricatetask.

Secondly, even though real traffic traces had led to checkconcordance between tail index and self-similarity exponent,only was it perceived for a given network configuration thatnecessarily corresponded to a single particular value of theparameters set. An extensive test, to verify that self-similarityexponent obeys the same rule when the tail index is forced torange over some interval of interest, was never performed ona large scale real network platform.

Finally, the exact role of the exchange protocol, viewedas a subsidiary factor from this particular model, is stillcontroversial [10], [11], [12]. Due to the lack of flexible,versatile, while realistic experimental environments, part ofthis metrology questioning has been addressed by researchersof the network community, using simulators, emulators orproduction platforms. However, these tools have limitationson their own, which turn difficult the studies, and yield only

2

incomplete results.In the present work, we use the potential and the facilities

offered by the very large-scale, deeply reconfigurable andfully controlable experimental Grid5000 instrument [13] toempirically investigate the scope of applicability of Theoremproposed by Taqqu et al. [2], [7], [8].

Under controlled experimental conditions, we first prescribethe flow size distribution to different tail indices and comparethe measured traffic self-similar exponents with their corre-sponding theoretical predictions. Then, we elucidate the role ofthe protocol and of the rate control mechanism on traffic scal-ing properties. In the course, we resort to efficient estimators ofthe heavy-tail index and of the self-similarity exponent derivedfrom recent advances in wavelet based statistics and timeseries analysis. In our opinion, this revisited investigation isthe missing prerequisite to a rigorous methodological approachto assess the actual applicability conditions of this theoreticalbond regarding real applications. That is why we deemed im-portant to start with an advisedlyelementaryand yetrealistictraffic pattern, run on a real platform, under plainly controllednetwork configurations. The sequel is organized as follows.Section II summarizes related works. Section III elaborateson theoretical foundations of the present work, including aconcise definition of parameters of interest. In Section IVwe develop the specifities of our experimental testbed, andwe describe our experimental designs. Section V presents andcomments the results. Conclusions and perspectives are drawnin Section VI.

II. RELATED WORK

Without giving full bibliography on the subject (many canbe found in [4], [5], [14]), there have been extensive reportson self-similarity in network traffic. As most of them arebased on measurements and on analysis of real-world tracesfrom the Internet, they only permit experimental validation ofa single point on the prediction curve of Taqqu’s Theorem,corresponding to one particular configuration. As its waspresented before, the question here is more on the relationbetween these two properties. This relation is rooted in theseminal work [2], [7] about the M/G/N queueing modelswith heavy-tailed distributions of ON periods. Nonetheless,first experimental works by Crovella and co-authors [3], [11],hinted that this theoretical relation holds for internet traffic,and later on, also for more general types of traffic [10], [12].However, due to the impossibility of controlling importantparameters when monitoring the Internet, only compatibilityof the formula could be tested against real data , but there isnostatistically grounded evidences that self-similarity measuredin network traffic is the work of this sole equality. On the otherhand, study of self-similarity at large scales is very sensitive toinevitable non-stationnarities (day and week periodicities forinstance) and to fortuitous anomalies existing on the Internet(see for instance [15]). It seems that the question has, since,never received a full experimental validation. In order toobtain such a validation, an important feature is to be ableto make the heavy-tail index vary, now there is only fewattempts to validate the relation under these conditions. One

is conducted in [11], that uses a network simulator, and wheresome departure from the theoretical prediction is reported(Fig.3 in this article). This deviation is probably caused by thelimited length of the simulation and also by the bias introducedby the used scaling estimator (R/S and Variance-Time) onshort traces. Actually, the main restriction of simulatorsliesin their scalability limitation, and in the difficulty of theirvalidation. Indeed, the network is an abstraction, protocolsare not production code, and the number of traffic sourcesor bitrates you can simulate depends on the computing powerof the machine.

Large-scale experimental facilities are alternatives that mayovercome both Internet and simulators limitations as theypermit to control network parameters and traffic generation,including statistics and stationarity issues. Emulab [16]is anetwork experimental facility where network protocols andservices are run in a fully controlled and centralized envi-ronment. The emulation software runs on a cluster wherenodes can be configured to emulate network links. In anEmulab experiment, the user specifies an arbitrary networktopology, having a controllable, predictable, and reproducibleenvironment. He has full root access on PC nodes, and hecan run the operating system of his choice. However, thecore network’s equipments and links are emulated. The RONtestbed [17] consists of about 40 machines scattered aroundthe Internet. These nodes are used for measurement studiesand evaluation of distributed systems. RON does not offerany reconfiguration capability at the network or at the nodes’level. The PlanetLab testbed [18] consists of about 800 PCs on400 sites (every site runs 2 PCs) connected to the Internet (nospecific or dedicated link). PlanetLab allows researchers to runexperiments under real-world conditions, and at a very largescale. Research groups are able to request a PlanetLab slice(virtual machine) in which they can run their own experiment.

Grid5000 [13], the experimental facility we use in thepresent work, proposes a different approach where the geo-graphically distributed resources (large clusters connected byultra high end optical networks) are running actual pieces ofsoftware in a real wide area environment. Grid5000 allowsreproducing experimental conditions, including network trafficand CPU usage. This feature warrants that evaluations andcomparisons are conducted according to a strict and scientificmethod. Grid5000 proposes a complimentary approach toPlanetLab, both in terms of resources and of experimentalenvironment.

III. T HEORY

Taqqu’s Theorem relates two statistical properties that areubiquitously observed in computer networks: On the one hand,self-similarity that is defined at the level of aggregated time-series of the traffic, and on the other hand, heavy-tailness thatinvolves grouping of packets. Simplistically, network trafficis described as a superposition of flows (without notions ofusers, or sessions,...) that permits us to adopt the followingsimple two-level model:(i) Packets are emitted and groupedin flows whose length (or number of packets) follows a heavy-tailed distributed random variable [19], [20], [21];(ii) the sum

3

over those flows approximates network traffic on a link or arouter. This crude description is coherent with current (yetmore elaborate) statistical model for Internet traffic [20], [21].

After a succinct definition of these two statistical properties,we present the corresponding parameter estimation proceduresthat we use in our simulations, and chosen amongst thosereckoned to present excellent estimation performance.

A. Self-similarity and long range dependence

1) Definition: Taqqu’s Theorem implies that Internet timeseries are relevantly modeled by fractional Brownian motion(fBm), the most prominent member of a class of stochasticprocesses, referred to asself-similar processes with stationaryincrements(H-sssi, in short). ProcessX is said to beH-sssiif and only if it satisfies [9]:

X(t) −X(0)fdd= X(u+ t) −X(u), ∀t, u ∈ R, (1)

X(t)fdd= aHX

(t

a

), ∀t, a>0, 0<H<1, (2)

wherefdd= means equality for all finite dimensional distri-

butions. Eq. (1) indicates that the increments ofX formstationary processes (whileX itself is not stationary). Es-sentially, self-similarity, Eq. (2), means that no characteristicscale of time can be identified as playing a specific role in theanalysis or description ofX . Corollarily, Eq. (2) implies thatEX(t)2 = EX(1)2t2H , underlining both the scale free andthe non-stationary natures of the process.

It turns out that the covariance function of the incrementprocess,Y (t) = X(t + 1) − X(t), of a H-sssi processXsatisfies, for|τ | → +∞:

EY (t)Y (t+ τ) ∼ EX(1)2H(2H − 1)|τ |2H−2, (3)

When 1/2 < H < 1, hence0 < 2 − 2H < 1, such a powerlaw decay of the covariance function of a stationary processis referred to as long range dependence [9], [14].

Long range dependence and self-similarity designate twodifferent notions, albeit often confused. The latter is associatedto non stationary time series, such as fBms, while the formeris related to stationary time series, such as fBm’s increments.In the present work, given that Taqqu’s Theorem predicts thatthe cumulated sums of aggregated Internet time series are self-similar, we adopt here the same angle and discuss the resultsin terms of self-similarity of the integrated traces.

2) Self-similarity parameter estimation:In [22], it wasshown that wavelet transforms provide a relevant procedureforthe estimation of the self-similarity parameter. This procedurerevealed particularly efficient at analyzing Internet timeseriesin [5], [6] and has then been massively used in this context.

Let dX(j, k) = 〈ψj,k, X〉 denote the (Discrete) WaveletTransform coefficients, where the collection{ψj,k(t) =2−j/2ψ0(2

−jt − k), k ∈ Z, j ∈ Z} forms a basis ofL2(R)[23]. The reference templateψ0 is termed mother-wavelet andis characterized by its number of vanishing momentsNψ > 1,an integer such that

∫tkψ0(t) dt ≡ 0, ∀k = 0, ..., Nψ − 1.

Then, decomposing aH-sssi process, the variance of thewavelet coefficients verifies [22]:

E|dX(j, k)|2 = E|dX(0, 0)|22j(2H+1), (4)

and, providedN > H + 1/2, the sequence{dX(j, k), k =. . . ,−1, 0, 1, . . .} form a stationary and weakly correlated timeseries [6]. These two central properties warrant to use theempirical meanS(j) = n−1

j

∑k |dX(j, k)|2, (nj being the

number of available coefficients at scale2j) to estimate theensemble averageE|dX(j, k)|2. Eq. (4) indicates that self-similarity transposes to a linear behavior oflog2 S(j) vs.log2 2j = j plots, often referred to as Logscale Diagrams(LD) in the literature [5], [6]. A (weighted) linear regressionof the LD within a proper range of octavesj1, j2 is used toestimateH .

In [5], [6], [22], the estimators performance are both theo-retically and practically quantified, and are proved to comparesatisfactorily against the best parametric techniques. Moreover,this estimator is endowed with a practical robustness thatcomes from its extra degree of freedomNψ. In practice, themain difficulty lies in the correct choice of the regression rangej1 ≤ j ≤ j2. This will be discussed in Section V, in the lightof actual measurements.

B. Heavy Tail

1) Definition: A (positive) random variablew is said tobe heavy-tailed, with tail exponentα > 0 (and notedα-HT)when the tail of its cumulative distribution function,Fw, ischaracterized by an algebraic decrease [24]:

P (w > w) = 1 − Fw(w) ∼ L(w) · w−α for w → ∞, (5)

where L(w) is a slowly varying function (i.e.∀a >0, L(aw)/L(w) →w→∞ 1). A α-HT random variablew hasfinite moments up to orderα. For instance, when1 < α < 2,w has finite mean but infinite variance. A paradigm forα-HTpositive random variable is given by the Pareto distribution:

Fw(w) = 1 −(

k

w + k

)α, (6)

with k > 0 andα > 1. Its mean reads:Ew = k/(α− 1).2) Tail exponent estimation:Estimation of the tail exponent

α for α-HT random variables is an intricate issue that receivedconsiderable theoretical attention in the statistics literature:measuring the tail exponent of a heavy-tailed distributionamounts to evaluate from observations, how fast does theprobability of rare events decrease in Eq. (5). Once randomvariables are know to be drawn from an a priori distribution,such as the Pareto form (6) for example, parametric estimatorsexist and yield accurate estimates of the tail indexα (seee.g. [25]). However, if the actual distribution of observationsdoes not match the a priori expectedα-HT model, parametricestimators fail at measuring the tail decay.

For this reason, the non-parametric empirical estimatorof α proposed in [26] will be preferred. The principle ofthis estimator is simple and relies on the Fourier mappingbetween the cumulative distribution functionFw(w) and thecharacteristic functionχw(s) of a random variable:

χw(s) =

∫e−isw dFw(w). (7)

4

By a duality argument, the tail exponentα that bounds theorder of finite moments ofFw,

α = supr{r > 0 :

∫|w|r dFw(w) <∞}, (8)

transposes to the local Lipschitz regularity of the characteristicfunctionχw at the origin, according to:

α = supr{r > 0 : 1 −ℜχw(s) = O(sr) ass→ 0+}, (9)

where ℜ stands for the real part. It is easy to recognizein this power law behavior ofℜχw(s), a scale invarianceproperty of the same type of that of relation (3), whichis conveniently identifiable with wavelet analyses. Hence,computing the discrete wavelet decomposition ofℜχw, andretaining only the wavelet coefficients that lie at the origink = 0, yields the following multiresolution quantity:

dχw(j, 0) = EΨ0

(2jw

)≤ C2jα for j → −∞, (10)

where Ψ0(·) denotes the Fourier transform of analyzingwaveletψ0(·). Now, let {w0, · · · , wn−1} be a set of i.i.d.α-HT random variables, and replace the ensemble average in Eq.(10) by its empirical estimator, the estimateα simply resultsfrom a linear regression of the form

log d(n)χw

(j, 0) = logn−1n−1∑

i=o

Ψ(2jwi)

≈ αj + logC, asj → −∞. (11)

The estimator was proved to converge for all heavy-taileddistributions, and also it has a reduced variance of estimationin O(n−1), wheren is the sample size. We refer the interestedreader to [26] where robustness and effective use of thisestimator are thoroughly studied. Yet, let us mention theexistence of a theoretical scale range where the linear model,Eq. (11), holds, and which shows very helpful for practitionersto adequately adjust their linear fitting over a correct scalerange.

C. Taqqu’s Theorem

A central result for interpreting statistical modeling ofnetwork traffic is a celebrated Theorem due to M. Taqqu andcollaborators [2], [7], [8], in which heavy-tailness of flowsessions has been put forward as a possible explanation forthe occurrence of self-similarity of Internet traffic.

The original result considers a M/G/N queueing modelserved byN independent sources, whose activitiesZi(t),i ∈ {1, ..., N}, are described as binary ON/OFF processes.The durations of the ON periods (corresponding to a packettrain emission by a source) consists of i.i.d. positive randomvariablesτON, distributed according to a heavy-tail lawPON ,with exponentα = αON . Intertwined with the ON periods,the OFF periods (a source does not emit traffic), have i.i.d.random durationsτOFF drawn from another possibly heavy-tailed distributionPOFF with tail index α = αOFF . Thus,theZi(t) consist of a0/1 reward-renewal processes with i.i.d.activation periods.

Now, let YN (t) =∑Ni=1 Zi(t) denote the aggregated traffic

time series and define the cumulative processXN(T t):

XN (tT ) =

∫ Tt

0

YN (u)du =

∫ Tt

0

(N∑

i=1

Zi(u)

)du. (12)

Taqqu’s Theorem (cf. [7]) states that when taking the limitsN → ∞ (infinitely many users) andT → ∞ (infinitely longobservation duration), in this order, thenXN (tT ) behaves as:

XN (tT ) ∼ EτON

EτON + EτOFFNTt+ C

√NTHBH(t). (13)

In this relation,C is a constant andBH denotes a fractionalBrownian motion with Hurst parameter:

H =3 − α∗

2, whereα∗ = min(αON , αOFF , 2). (14)

The order of the limits is compelling to obtain this asymptoticbehavior; this has been discussed theoretically elsewhereandis beyond the issues we address here. The main conclusionof Taqqu’s Theorem is that, in the limit of (infinitely) longobservations, fractional Brownian motions superimposed to adeterministic linear trend, are relevant asymptotic models todescribe the cumulated sum of aggregated traffic time series.Moreover, Eq. (14) shows that only heavy-tailed distributionswith infinite variance (i.e.,1 < min(αON , αOFF ) < 2) cangenerate self-similarity associated to long range dependence(i.e.H > 1/2). Conversely, when both activity and inactivityperiods have finite variance durations,α∗ = 2 and conse-quentlyH = 1/2, which means no long range dependency.

IV. EXPERIMENTAL SETUP

To study the practical validity of Taqqu’s result, we use thepotential and facilities offered by the very large-scale, deeplyreconfigurable and fully controllable experimental Grid5000instrument, so as to overcome the limitations previously ex-posed of emulations, simulations or measurements in produc-tion networks. Moreover, we deliberately chose to work withthe simplest network configurations that permit a thoroughinvestigation of the Taqqu’s Theorem: Namely, an elemen-tary network topology encompassing multiples independentsources whose throughputs aggregate on a single hop, anda traffic generation without congestion. This way, we isolatethe nature of the flows’ distributions as the main entry forTaqqu’s relation. After a general overview of Grid5000, themetrology platform is then described. Design of a large set ofexperiments, aimed at studying the actual dependence betweenthe network traffic self-similarity and the heavy-tailnessofflow size distributions, is finally detailed.

A. Grid5000 instrument overview

Grid5000, is a 5000 CPUs nation-wide Grid infrastructurefor research in Grid computing [13], providing a scientifictool for computer scientists similar to the large-scale instru-ments used by physicists, astronomers, and biologists. It isa research tool featured with deep reconfiguration, controland monitoring capabilities designed for studying large-scaledistributed systems and for complementing theoretical models

5

and simulators. Up to 17 french laboratories involved and 9sites are hosting one or more cluster of about 500 cores each.A dedicated private optical networking infrastructure, providedby RENATER, the French National Research and EducationNetwork is interconnecting the Grid5000 sites. Two inter-national interconnections are also available: one at 10 Gb/sinterconnecting Grid5000 with DAS3 in the Netherlands andone at 1 Gb/s with Naregi in Japan. In the Grid5000 platform,the network backbone is composed of private 10 Gb/s Ethernetlinks connected to a DWDM core with dedicated 10 Gb/slambdas with bottlenecks at 1 Gb/s in Lyon and Bordeaux(see Figure 1).

Grid5000 offers to every user full control of the requestedexperimental resources. It uses dedicated network links be-tween sites, allows users to reserve the same set of resourcesacross successive experiments, to run their experiments indedicated nodes (obtained by reservation) and it permits usersto install and to run their own experimental condition injectorsand measurement software. Grid5000 exposes two tools toimplement these features: OAR is a reservation tool, andKadeploy an environment deployment system. OAR offers anaccurate reservation capability (CPU/Core/Switch reservation)and integrates the kadeploy system. With Kadeploy, eachuser can make his own environment and have a total controlon the reserved resources. For instance, software and kernelmodules for rate limitation, QoS mechanisms, congestion con-trol variants can be deployed automatically within the nativeoperating system of a large number of communicating nodes.OAR also permits users to reserve equipements for severalhours. As a consequence, Grid5000 enables researchers torun successive experiments reproducing the exact experimentalconditions several times, an almost impossible task with sharedand uncontrolled networks. This insures also large-durationobservation windows under stationary conditions – somethingthat is unachievable on the Internet. As a private testbed,Grid5000 turns the installation of experimental hardware,likefor instance the traffic capture instrument at representativetraffic aggregation points, quite easy.

B. Metrology platform

Using the facilities offered by Grid5000, a platform formetrology has been designed, and schematized in Fig. 2.Before describing the monitoring facilities and the developeddata processing softwares, let us present the effective topologyused for this experiment.

1) Experimental system description:Unless explicitly men-tioned, all our experiments consist in producing data flowtransfers between many independent client nodes (sources)andmany independent server nodes (destinations). It is a classicaldumbbell (or butterfly) topology with a single bottleneck ofcapacity, here ofC = 1 Gb/s. We selectedN = 100 nodesthat are able to send up to atCa = 1 Gb/s on each direction(see Fig. 2)

For our experiments, we used nodes on the Grid5000clusters of Lyon (clients) and Rennes (servers). The averageRTT is then stable and equal to 12 ms, which gives abandwidth-delay product of 1.5 MBytes. In our forthcoming

10G link

Site

used by experience

1G link

274 CPUs

520 CPUs

684 CPUs

198 CPUs

334 CPUs

48 CPUs270 CPUs

356 CPUs

424 CPUs

Fig. 1. Grid5000 backbone

PC 1

Rennes

PC 99

PC 100

PC 2

Switchrouter

GtrcNet1 Captureserver

PC 1

PC 2

PC 99

PC 100

routerSwitch

Bottleneck

Lyon

5 Mb/s

5 Mb/s

5 Mb/s

5 Mb/s

C = 1 Gb/s

RTT = 12 ms

Fig. 2. Metrology platform overview

scenarii, TCP and UDP transfers are realized by usingiperf[27] on Sun Fire V20z (bi-opteron) workstations of Grid5000[13], running GNU/Linux 2.6.18.3 kernels with standard TCPand UDP modules. Iperf is a traffic generation tool that allowsusers to tune the different TCP and UDP parameters and toevaluate their impact on network performance.

This single bottleneck topology was intentionally chosenas our main goal was not to study the queueing effect ofsuccessive routers in a multiple hops network. We believethat, without loss of generality, the simplicity of this testtopology suffices at properly creating the realistic experimentalconditions for investigating the limits of Taqqu’s Theorem.

2) Capture system:To measure the traffic at packet-level,we designed a specific system combining packet capture,header extraction and dedicated data analysis software. Packetsare first captured by mirroring the traffic of the access linkconnecting the Lyon site to the rest of Grid5000. Only theoutgoing traffic from the Lyon site to Grid5000 is mirrored,

6

connecting a 1 Gb/s fiber port to a 1 Gb/s copper port directedto the monitoring system.

This system is composed of a GtrcNET-1 device [28],developed by AIST GTRC, and based on an FPGA that hasbeen programmed to extract and aggregate packet headersand send them to an attached server. This header aggregationreduces the number of interrupts of the computer that receivethe traffic to analyse, decreasing the local loss probability.In the packet capture system, the GtrcNET-1 is configuredto extract a 52-Bytes headers (composed of 14, 20 and 18Bytes of Ethernet, IP and TCP headers respectively) from thepackets arriving at the one gigabit port. Headers are addeda time-stamp each, encapsulated by groups of 25 into a UDPpacket and then sent to another gigabit port. Time-stamps havea 60 ns (2−24 s) resolution.

The concatenated headers are stored in a computer witha quad core processor running at 2.66 GHz, 4 GB memory,2 ethernet gigabit ports, 300 GB SAS disk for the system,1 RAID controller with 5 x 300 GB SAS disk in a RAID0 array offering 1500 GB available for storing capture files.We developed a driver that reads GtrcNET-1 packets, de-encapsulates time-stamped packet headers and writes them toa file in the pcap format.

3) Data processing and Flow Reconstruction:We use aseries of tools over the captured IP traffic traces, to go fromthe packet-level traces to the aggregated traffic and the flowstatistics that are needed in this work. A first step is to handlethe captured IP traffic traces; secondly, we reconstruct theflows from the packets1.

IP traffic traces, saved in standard pcap format by thecapture device, are first processed byipsumdump, a programdevelopped at UCLA [29], able to read the pcap format andto summarizes TCP/IP dump files into a self-describing binaryformat. Thanks to this tool, we retrieve from our traces theneeded informations: time-stamps, source and destinationIPs,port numbers, protocol, payload size, TCP flags, and sequencenumbers. The informations are condensed into a binary filethat is easier to parse, and which doesn’t depend on specificcapture hardware anymore.

Secondly, we have developed a collection of tools workingon theipsumdump binary format directly, which performsa variety of useful data operations on the traces. Of relevantinterest here are: computation of the aggregated traffic timeseries (used for self-similarity estimation); extractionof trafficsub-traces for conditioned study, based on flows or packetsrandom sampling, or on parameters filtering (traffic from/toa list of IPs, traffic on given ports, traffic using a specificprotocol, etc); and reconstruction of the flows existing in thetraces.

The question of flow reconstruction is an intricate problem,that is an important and difficult aspect when one wants tostudy the impact of their heavy-tailness [14], [30], [31], [32].It is necessary to recompose each flow from the intertwinedpackets stream measured on an aggregated link. This meanswe must identify and group all the packets pertaining to the

1Using standard flow monitoring tools, such as Netflow or Sflow,wouldnot be sufficient here. Indeed, we need statistical characterization at bothpacket-level (forH-sssi) and flow-level (forα-HT).

same set, while considering a significantly large number offlows to guarantee statistical soundness. This constraint facesthe arduous issue of loss free capture, and that of dynamictable updating.

In our tool, flows are classically defined as a set of packetsthat share the same 5-uplet comprising: source and destinationIPs, ports, and protocol. However, because there is a finitenumber of ports, it is possible for two different flows to sharethe same 5-uplet, and thus to get grouped in a single flow. Toavoid this, we set atimeout threshold: a flow is consideredas finished, if its packet train undergoes an interruption lastingmore thattimeout. Any subsequent packet with the same 5-uplet will tag the beginning of a new flow. Naturally, a properchoice oftimeout is delicate, but that is the only solutionthat works for any kind of flows. For TCP flows, though, thingsare easier, as we can use the SYN or SYN/ACK flags to initiatea flow (closing any currently open flow with the same 5-uplet),and the FIN or RCT flag to close the flow, dispensing withtimeout. Note thattimeout remains necessary when theFIN packet is accidently missing.

Flow reconstruction (withtimeout) is then performedin a table that contains all currently open flows, using hashfunctions to speed up the access. The relatively modest tracebitrate allows for keeping the whole table in memory. SinceTCP sequence numbers and payload size for TCP packets arecaptured, it is possible to search for dropped or re-emittedpackets during the flow reconstruction and take that intoaccount. Elementary statistics on the flows are then available:number of packets, number of Bytes, duration of the flow, etc.

All together the data processing tools extract the twoelements needed for this study: the aggregated time-seriesatpacket-level, and the experimental flow-size distributionofany traffic that will be sent through, and monitored in themetrology platform of Grid5000.

C. Rate limitation mechanisms

The last major aspect of the experimentation is the carefuldesign of traffic generation. In real networks, flows are not thefluid ON/OFF flows of theM/G/N model: packets compos-ing the flows are sent entirely, one after the other, at the wirebit-rate. This acts as an ON/OFF sending process. Followingon, a critical feature to consider in network experiment design,is the mechanism of traffic generation, especially the rate atwhich the packets are sent. An important parameter is theaggregation level of the trafficK, defined as the ratio betweenthe bottleneck capacityC and the access link nominal capacityCa. In xDSL context and more generally in the Internet, it isnot rare to have K ranging over 1000, while in the data-centercontext, K is around 1 or 10. In our Grid5000 setup the Kfactor is close to 1. To obtain a K factor larger than 100 (soas to mimic the natural rate limit based upon the bandwidth ofthe users’ uplink in the Internet configuration) and to insurean aggregated throughput average lower thanC = 1 Gb/s, thesources rate has to be limited at most to 10 Mb/s.

End-host based mechanisms can control the individual flowsin a scalable and simple way [33]. When considering fixedsize packets, the way to modify data rates over a large period

7

of time is to vary inter-packets intervals. To calculate theseintervals, one considers the time source that can be used toenforce the limitation. In end-host systems, four different timesources are available: a) userland timers, b) TCP self clockingnamelyRTT of the transfer’s path, c) OS’s kernel timers, d)packet-level clocking. In our experiments we used three ratelimitation approaches which act at different time scales: thefirst one is based on packet-level clocking (packet spacer),thesecond one on OS’s kernel timers (Token Bucket), the lastone on TCP self clocking namelyRTT of the transfer’s path(window size limitation).

The first two methods rely on the linux traffic shapingmechanism: with thetc utility [34], the qdisc associatedto a network interface (the queue in which packets are putbefore being sent to the network card) is configured. ThePSP (PSPacer) [35] qdisc spaces packets by inserting IEEE802.3x PAUSE packets. These PAUSE packets are discardedat the input port of the first switches. With this mechanism,packets are regularly spaced and short bursts are avoided. Thesecond method resorts to HTB (Hierarchical Token Bucket)qdisc [36] that uses a bucket constantly filled by tokens at theconfigured target rate. With this qdisc the average rate limitcan be overridden during short bursts.

The third and last method modifies the TCP window sizeto slow down the throughput. The formulawindow size =target throughput × RTT determines the TCP window sizeto use to limit the sending rate totarget throughput . Thismechanism works well if the window size is not to small,which means also that the target throughput and/or theRTTshould not be too small either. As the TCP limitation actsfor each TCP connection, many sources located on the samenode can have independent rate limitation which is not the casefor qdisk-based limitation mechanisms. To limit the rate ofa1 Gb/s source to 5 Mbps with full size (1500 Bytes) Ethernetpacket andRTT of 12 ms one has to fix the window size to7.5 kBytes (corresponding to 5 full-size Ethernet packet).

D. Experiments description

Using the facilities offered by Grid5000, our metrology fa-cilities and the rate control mechanisms for traffic generation,several experiments were performed, and we elaborate here ontheir rationale. First, the general experimental conditions arepresented.

The primary interest here is the effect of flow size dis-tributions on self-similarity, when each client behaves likea ON/OFF source model, where a ON period correspondsto a flow emission, and a OFF period to a silent source.The ON (respectively the OFF) lengths are random variablesdrawn independently and identically distributed, following thespecific probability distributionPON (respectivelyPOFF ) wewant to impose on the flow durationsτON (respectively, on thesilent periods,τOFF). The emission of packets in each flowis controlled by one of the methods described in previousSection, each source rate being limited to 5 Mb/s to avoidcongestion at the 1 Gb/s bottleneck.

All experiments consist of one trace of 8-hour traffic gener-ation, representing a total of approximatelyn = 5.106 flows.

description

Client nodes Sun Fire V20z (bi-opteron)Kernel GNU/Linux 2.6.18.3

TCP variant Bic, with SACKiperf version 2.0.2

Topology ButterflyBottleneck 1 Gb/s

RTT 12 msSources nb. 100Source rate 5 Mb/s

Exp. duration 8 hoursFlows nb. 5.106

Aggregation time ∆ = 100 µsFlow timeout timeout= 100 ms

TABLE IFIXED EXPERIMENTAL GLOBAL PARAMETERS.

As explained before, flows are reconstructed from the tracesand we extract their flow sizes (in packets)W = {wi, i =1, ..., n}, as well as the OFF times series corresponding to theinter-flow times for each source. Grouping and counting thepackets in each contiguous time interval of width∆ = 100µs, yields the aggregated traffic time seriesX(∆)(t).

In order to clearly define the terms of application of Taqqu’sTheorem on real traffic traces, as well as to identify possibleinteractions with other factors, we designed four series ofexperiments whose parameters are summarized in table II.

Experiment A: This is the cornerstone experiment to checkrelation (14). Distribution of the ON periods are prescribedto Pareto laws with meanµON = 0.24 s (corresponding toa mean flow size of〈P 〉 = 100 packets). The experiment isperformed ten times with different prescribed tail indexαON,varying from 1.1 to 4. OFF periods are kept exponentiallydistributed with meanµOFF = µON. For each value ofαON,an experimental point(αON, H) is empirically estimated.Moreover, to evaluate the possible influence of the protocol,and of the workload generation mechanism, the same series ofexperiments is reproduced with TCP (window size limitation)and with UDP (user-level packet pacing) first, and then usingPSP, HTB and TCP throughput controls. The exact same trialof random variables defining the flow lengths is used for allexperiments that imply the same probability lawPON.

Experiment B: Under similar conditions as in series A, themean of the ON periods takes on two different valuesµON =0.24 s andµON = 2.4 s, corresponding to mean flow sizes〈P 〉 = 100 and 〈P 〉 = 1000 packets, respectively. Theobjective is here to relate〈P 〉 to the lower scale bound∆j1 = 2j1∆ defining a sensible regression range to estimateH .

Experiment C: The protocol (TCP), the throughput limitationmechanism (TCP window limitation) and the mean flow size(〈P 〉 = 1000) being fixed, we investigate now to role ofthe OFF periods distribution on the self-similar exponentH .Distribution of the OFF periods are prescribed to Pareto lawswith meanµOFF = 2.4 s. The experiment is repeated withdifferent prescribed tail indexαOFF, varying from 1.1 to4. ON periods are kept exponentially distributed with meanµON = µOFF. For each value ofαOFF, an experimental point

8

Proto Band αON αOFF 〈P 〉 measlim param

A TCPPSP

1.1 – 4 - 100HTB bHTCP bα

UDP iperf

B TCP TCP 1.1 – 4 - 100∆

〈P 〉j11000

C TCP TCP - 1.1 – 4 1000 bH

D TCP TCP 1.1 – 4 - 100 bhlocUDP iperf

TABLE IIEXPERIMENTAL CONDITIONS SUMMARY.

(bα−

α)

1 1.5 2 2.5 3 3.5 4−0.8

−0.6

−0.4

−0.2

0

0.2

Prescribed tail exponentα

Fig. 3. Difference between the prescribed HT indexα and the actuallyestimated HT indexbα for the set of different values ofα used in experimentseries A (see Tab. II) for two different protocols: TCP (+) and UDP (◦).

(αOFF, H) is empirically estimated.Experiment D: The last series of experiments aims at inves-tigating self-similarity at finer scales (lower than theRTTscale), and whose origin is distinct from long range depen-dance phenomena. The variable parameter is the tail index asin experiment A, yet the scaling law index will be estimatedin the short time-scales limit, in order to characterize thetraffic burstiness from the processX(∆). Under the sameexperimental conditions as in series A, we then evaluate howthe protocols (TCP versus UDP) entail a significant change inthe traffic burstiness.

Specifically for series A and C, where ON and OFF periodsare statistically forced, it is crucial for those experiments toguarantee a zero loss traffic. Otherwise, flow lengths and/orsilence periods may deviate from the prescribed distributionsdue either to packet drop and re-emission, or to exponentialback-offs.

V. RESULTS AND DISCUSSION

A. Verifying Taqqu’s relation

For every trace, we use the wavelet-based methodologiesdescribed in Section III for heavy tail and self-similarityanalyses. The estimated tail indexα (corresponding to eitherαON or αOFF, clear from the context of Tab. II) results fromthe linear regression of Eq. (11) applied to the flow sizesequenceW (or the OFF times series), where a sixth orderderivative of a Gaussian wavelet is systematically used. Theself-similarity indexH is estimated from the LD plots of theaggregated time seriesX(∆), using a standard Daubechieswavelet with 3 vanishing moments [23].

1) Tail index estimates:Proceeding with experiment A, fordifferent values of the tail index of the flow size distribution,Fig. 3 displays the differences between the prescribed valueα and the actually estimated valueα. The two experimentalcurves, corresponding to TCP and UDP protocols respectively,superimpose almost perfectly. Beyond coherence with thefact that the exact same trial of random variables definingthe flow lengths is used in both cases, such a concordancedemonstrates that the flow reconstruction procedure, for bothTCP or UDP packets grouping, is fully operative, notablyincluding a relevanttimeout adjustment (timeout = 100ms).

Fig. 3 also shows an increasing difference (α− α) with α.In our understanding, this is not caused by an increasing biasof the HT estimator, which is known to perform equally wellfor all α values. It is rather caused by the natural difficultyto prescribe large values ofα over fixed duration. Indeed, asα increases, large flows become more rare, and the numberof observed elephants during the constant duration (8 hours)of the experiments naturally decreases, then deviating from astatistically relevant sample. This observation is fully consis-tent with arguments developed in [37]. Notwithstanding thissatisfactory agreement, in the sequel we will systematicallyrefer to α rather than to the prescribedα.

2) Gaussianity:Before verifying the presence of long rangedependence in the aggregated traffic time series, we first needto validate the normal assumption (recall that the incrementprocess of a fBm is a stationary and Gaussian process). Thus,for each trace described in Tab. II, the Kurtosis index2 ofthe aggregated traffic time series distribution was computed atseveral different aggregation intervals. As, the Kurtosisindexwas always found to lie between3.0 and3.1, for aggregationintervals larger than∆ = 10 ms, we conclude that theaggregated traffic time series is a reasonably Gaussian processbeyond this limit.

3) LD-description: Fig. 4 shows typical LDs of aggre-gated traffic time series, obtained under similar conditions(experiment series A of Tab. II, TCP protocol, TCP windowlimitation), for 4 different values ofα. Such plots enablea generic phenomenological description of LDs:3 differentranges of scales can be visually identified, whose bounds donot seem to drastically vary withα:

Coarse scales: In the coarse scale domain, a clear scalingbehavior is systematically observed. As mentioned earlier,Taqqu’s Theorem relates heavy tails and self-similarity inthe asymptotic limit of coarse scales. Therefore, the scalingexponent at coarse scales, denotedH , is a candidate to matchthat involved in relation (14).

Fine scales: At fine scales, another clear scaling behavioris also observed. However, the corresponding scaling index,denotedh, is no longer related to Taqqu’s Theorem predictionbut rather to a local regularity property of the data.

Medium scales: Intermediate scales mostly connect the twoscaling behaviors happening for fine and coarse scales, butexhibit no noticeable scaling behavior.

2The Kurtosis index of a R.V. is defined as the ratio of its fourth ordermoment over its square variance, and takes on the value3 in the normal case.

9

0.1ms 1ms 10ms 100ms 1s 10s 100s 1000s 10000s−20

−10

0

10

20

30

40

50

60

RTT µON

αON

= 1.1

αON

= 1.5

αON

= 1.9

αON

= 4.0

Time scale2j∆

Fig. 4. Wavelet log-diagramslog S(j) versus time scalej of aggregatedtraffic (aggregation interval∆ = 100 µs). Log-diagrams correspond to 4 timeseries obtained under similar experimental conditions with the protocol TCP,with 4 different values ofαON: 1.1 (+), 1.5 (△), 1.9 (◦) and 4.0 (♦). For thesake of readability, curves were vertically shifted to avoid overlapping.

In Fig. 4, vertical lines materialize the two transition scalesbetween the three depicted domains and can hence be iden-tified as characteristic time scales of the data. Let us nowinvestigate the nature of these characteristic times.

10ms 100ms 1s 10s 100s 1000s−10

−8

−6

−4

−2

0

2

∆100

j ∆1000

j

Time scale2j∆

Fig. 5. Averaged normalized log-diagrams for two differentmean sizes〈P 〉of the transmitted flows: (×) 〈P 〉 = 1000 packets – (△) 〈P 〉 = 100 packets.

4) Coarse scales domain lower bound:It is alluded in [21]that the range of scales where self-similarity can be measuredis beyond a characteristic scale, referred to as theknee ofthe LD, and that it is essentially controlled by the meanflow duration. To investigate this argument in the contextof our analyses, we designed two experiments series withtwo different values of the mean flow duration (series B ofTab. II). For each case, all the LDs corresponding to thedifferent values ofα are computed. To emphasize the impactof the mean flow duration, we substracted to each LD, theasymptotic linear trend, obtained by linear regression betweena scale∆j1 , clearly above thekneeposition, and the maximumavailable scale∆jmax

. Fig. 5 shows, both for〈P 〉 = 100and 〈P 〉 = 1000 the mean and standard deviation over all

0.1ms 1ms 10ms 100ms 1s 10s 100s−10

0

10

20

30

40

50

+ : TCP protocolo : UDP protocol

RTT µON

Time scale2j∆

Fig. 6. Wavelet log-diagramslog S(j) versus time scalej of aggregatedtraffic (aggregation interval∆ = 100 µs). Log-diagrams correspond to twotime series obtained under similar experimental conditions, for αON = 1.5,with two different protocols: TCP (+) and UDP (◦).

normalized LDs. Each graph clearly exhibits a slope break:at scale∆100

j = 0.64 s when 〈P 〉 = 100 and at scale∆1000j = 10.28 s when〈P 〉 = 1000. Although for〈P 〉 = 100,

the knee effect slightly smoothes out, the linear behaviorobserved for〈P 〉 = 1000 clearly extends with the sameslope beyond∆1000

j up to∆100j . Unquestionably, the measured

knee position undergoes the same variations as the mean flowduration, both quantities being in the same order of magnitude:∆100j ≃ µON

100(0.24 s) and∆1000j ≃ µON

1000(2.4 s). This analysisconfirms the intuition that the coarse scale range, where self-similarity is to be measured, lies above thekneeof the LD,whose position is in the same order of magnitude as the meanflow duration. The coarse scales can then be renamed: theflowscales, or thefile scales.

5) Protocol, rate limitation and coarse scales:As weinvestigate Taqqu’s relation, we now focus on the coarse scaledomain. To inquire on the impact of the protocol on the coarsescales, Fig. 6 shows the LDs obtained with two differentprotocols : TCP and UDP (forα = 1.5). Fig. 6 evidencesthe central feature that both LDs are undistinguishable inthe coarse scale domain. We conclude that, when source ratelimitation precludes congestion, the protocol has no impact onthe coarse scale SS.

Similarly, to inquire on the impact of the rate limitationmechanism on the coarse scales, Fig. 7 shows typical LDs(α = 1.5, TCP) obtained with three different rate limitationmechanisms: PSP, HTB and TCP window limitation. As thethree LDs cannot be distinguished one from the other in thecoarse scale domain, we conclude that the rate limitationmechanism has no influence on the scaling behavior at coarsescales.

6) H versusαON: Practically, to perform an empirical val-idation of Eq. (14), we need to estimate the scaling parameterH and thus to carefully choose the range of scales where theregression is to be performed. Although thekneeposition hasbeen related to a measurable experimental parameter (the meanflow duration), a systematic choice of the regression rangeat coarse scales would certainly be hazardous. Instead, wedefined for each trace an adapted regression range, based on a

10

(a) (b)

Est

imat

edS

Sin

dexb H

1 1.5 2 2.5 3 3.5 40.3

0.4

0.5

0.6

0.7

0.8

0.9

1

1.1

Est

imat

edS

Sin

dexb H

1 1.5 2 2.5 3 3.5 40.3

0.4

0.5

0.6

0.7

0.8

0.9

1

1.1

Estimated tail indexbαON Estimated tail indexbαON

Fig. 8. Estimated Self-Similar indexbH of the aggregated traffic (aggregation interval∆ = 100 µs) versus estimated tail indexbαON of the correspondingflow size distribution. Solid plots represent the theoretical model of relation (14), dashed plots correspond to experimental results: (a) with TCP protocol; (b)with UDP protocol.

0.1ms 1ms 10ms 100ms 1s 10s 100s−10

0

10

20

30

40

50

+ : TCP limitationo : PSP limitation△ : HTB limitation

RTT µON

Time scale2j∆

Fig. 7. Wavelet log-diagramslog S(j) versus time scalej of aggregatedtraffic (aggregation interval∆ = 100 µs). Log-diagrams correspond to 3 timeseries obtained under similar experimental conditions, for αON = 1.5, withthree different rate limitation mechanisms: TCP (+), PSP (◦) and HTB (△).

linearity criterion, and found that all regression ranges definedlike this, encompass a scale interval (maxα∆j1 = 20.5 s and∆jmax

= 1310 s), significantly extended to warrant statisticallyreliable SS exponent estimates.

Fig. 8 plots the estimates of coarse scale SS exponentsagainst those of the HT indices. Confidence intervals forH displayed on the graphs are supplied by the estimationprocedure detailed in Section III-A2 [6], [22] (recall thatnormal hypothesis underlying the estimation of these confi-dence intervals was successfully verified on our data). Suchestimations are conducted independently for TCP and UDPprotocols. For both protocols, estimations show a very satis-factory agreement with Taqqu’s Theorem prediction. To thebest of our knowledge, this theoretical relation between self-similarity and heavy tail had never been observed with such asatisfactory accuracy, (over a large and significant range of αvalues). For instance, and although no definitive interpretationhas been proposed yet, the offset below the theoretical relationfor α close to 1, and the offset above the horizontal line forα

larger than 2 have been drastically reduced when compared tosimilar analyses results reported in the literature (cf. e.g., [11]).This accuracy results from a number of factors: Firstly, thestatistical tools for estimatingH andα are chosen amongst themost recent and robust (notably the proposed estimator forαhad never been applied before to Internet data); Secondly, theasymptotic coarse scale nature of Taqqu’s Theorem is reallyaccounted for by performing estimation in the limit of reallycoarse scales; Thirdly, this is made possible thanks to the useof really long duration, stationary and controlled traffic timeseries, wich is enabled by the use of Grid5000 platform.

Additionally, our analyses do confirm that TCP and UDPprotocols do not impact this relation, at least under congestionavoidance conditions corresponding to our experimental setup.This is in clear agreement with the findings reported in [12],or [10], showing that TCP is not responsible for the observedself-similarity. However, despite these earlier results,a nonnegligible number of contributions debated, investigatedandargued in favor of an impact of protocols on self-similarity.Our analyses clearly show that the range of scales whereprotocols impact the LD is far below the characteristic timescales involved in self-similar phenomena.

As long as we actually consider coarse scales (larger thanthe mean duration of a flow), the only cause for self-similarityis the heavy tail in the flow sizes distribution.

7) OFF periods: To complement the experimental studyof Taqqu’s Theorem, the experiments of series C (see Tab.II) were designed to assess the influence of heavy-taileddistributed OFF periods on the coarse scale SS exponentH . Under experimental conditions detailed in Tab. II, Fig. 9displays the estimated coarse scale SS exponents against thoseof the OFF periods HT indices. Since we previously validatedthat the protocol has no influence on the scaling behavior incoarse scales, these experiments were only performed withTCP protocol.

In contrast to similar results reported in the literature (cf.e.g., Fig. 5 (right) of [11], where the estimated value ofH isless than0.7, even forαOFF = 1.05), our results show a perfect

11

Est

imat

edS

Sin

dexb H

1 1.5 2 2.5 3 3.5 40.3

0.4

0.5

0.6

0.7

0.8

0.9

1

1.1

Estimated tail indexbαOFF

Fig. 9. Estimated Self-Similar indexbH of the aggregated traffic (aggregationinterval ∆ = 100 µs, TCP) versus estimated tail indexbαOFF of thecorresponding OFF periods distribution. Solid plots represent the theoreticalmodel of relation (14), dashed plots correspond to experimental results.

agreement with the theoretical relation of Eq. (14). Reasons forthis theoretical accord certainly lies in the same origins as theones evoked in the previous Paragraph (i.e. robust estimators,long-duration stationary traces and controlled configurations),but possibly also, in the fact that we scrupulously avoidedcongestion, hence statistical alteration of the OFF periods. Tothe best of our knowledge, this other part of Taqqu’s Theoremhad never been satisfactorily addressed.

Finally, let us notice that confidence intervals displayed inFig. 9 are significantly larger than the ones of Fig. 8. This isdue to the difficulty of imposing short OFF intervals that ledus here to increase the mean durationµOFF = µON = 2.4 s(instead of0.24 s). In accordance with the interpretation ofFig. 5, the coarse scale regression range is then consequentlyreduced.

B. Further analyses of the LD

In previous Section, we focused on the coarse scales of LDs.Let us now turn to the medium and fine scales and study theinfluence of protocols and rate limitation mechanisms.

1) Medium scales:Firstly, let us notice that, while themean flow duration gives an upper bound for the mediumscale domain,RTT (12 ms) seems to correspond to its lowerbound. Therefore, this medium scale range will be referred toas theRTT -scales. Although no scaling behavior is visible inthis medium scale range, Fig. 6 shows a significant differencebetween the LDs obtained from TCP and UDP traffic. This isan expected result asRTT is the characteristic time of actionof TCP protocol.

Fig. 7 shows that there is no significant difference in thisdomain between the LDs corresponding to the three differentrate limitation mechanisms. The characteristic time of actionof the rate limitation is the mean inter-packet time. Due tothe source rate limitation at5 Mb/s achieved with 1500-Bytespackets, the mean inter-packet time for one source is2.4 ms.As the mean number of sources emitting simultaneously is50, the mean inter-packet time is 48µs, which is much lower

thanRTT . Accordingly, the rate limitation does not impactthe traffic atRTT scales.

b h

1.1 1.5 2 3 40.3

0.35

0.4

0.45

0.5

0.55

0.6

0.65

Tail index αON

Fig. 10. Fine scale scaling exponenth estimates on aggregated traffic timeseries (∆ = 100µs). For different values of the tail indexαON governing theflow size distributions,h is estimated by linear regression of Log-diagrams(see Fig. 6) over the scale range[0.2 − 5]ms. Notched box-plots correspondto UDP protocol, regular box-plots to TCP protocol.

2) Fine scales: TCP and UDP impact on fine scalesscaling.Figure 6 shows a good scaling behavior at fine scales,with a scaling index which seems to be different for UDP andTCP.

To analyze in more details the fine scales scaling exponent,each 8-hour trace corresponding to a particular value ofα(see experimental conditions of Experiment A in Table II) arechopped into 66 short-length of durationT = 100 s each. Theresulting time series are then analyzed independently and afine scaling exponenth estimated. Hence, based on these 66values of h, box-plots are displayed on Figure 10 for eachtheoretical value ofα. The values for TCP remain roughlyconstant aroundh ≃ 0.63. Likewise for UDP,h does not seemto depend onα, but stands around0.4, a significantly smallervalue than that for TCP.

Smaller thanRTT , these fine scales correspond to thepacket-scales. Clearly then, the scaling index at these scalesis sensitive to the packet sending mechanism. When usingUDP, packets are emitted individually, separated by an inter-packet interval (2.4 ms) imposed by iperf to maintain therate limitation (5 Mb/s). Therefore, UDP traffic is constantlyand erratically varying. When using TCP, packets are sentby bursts containing up to 5 packets. Then TCP traffic isbursty, but also sparse, with “long” periods of no packets.We believe that this packet sending scheme difference, inclose relationship with our experimental condition (source ratelimitation used to avoid congestion) is sole responsible forthe observed difference between TCP and UDP on the localregularity.Bandwidth limitation impact on fine scales scaling.Figure7 shows that the scaling index at fine scales is approximatelythe same with TCP and HTB limitation, but it is very differentwith PSP limitation. This difference can again be explainedbythe packet sending mechanism. When using HTB limitation,packets are sent by bursts, in the same way as with TCPlimitation. This explains why the local regularity observed

12

with HTB is the same as the one observed with TCP windowlimitation. On the contrary, when using PSP, packets are sentindividually, in the same way as with UDP. Then, at fine scale,the scaling index observed with PSP is lower than the oneobserved with TCP limitation, as was the one observed withUDP.

VI. CONCLUSIONS AND PERSPECTIVES

In this paper, we experimentally demonstrated that thetraffic generated on a real network platform conforms to thetheoretical bond between the file sizes distribution and theself-similar nature of instantaneous throughput measuredat thelink level. This work is based on three important innovativefactors: the use of accurate estimation tools, a deeper analysisof Taqqu’s Theorem applicability conditions and the use of alarge scale reconfigurable experimental facility. The waveletbased estimation procedure forH is known as a state-of-the-art tool, being one of the most reliable and robust (againstnon stationarities). Here, it has been used with most care.The α index estimation procedure used here, shown to out-perform previous available techniques, had never been usedbefore in the context of Internet data. Widely reckoned, thedeeply asymptotic nature of Taqqu’s Theorem has been betteraccounted for by conducting estimations of the self-similarityparameter at really coarse scales (coarse quantifying scalesthat lie far beyond the system dynamic). This asymptoticlimit requires to produce traffic with particularly long obser-vation duration, yet stationary, and well controlled. The nationwide and fully reconfigurable Grid5000 instrument enablesgeneration, control and monitoring of a large number offinely controlled transfer sessions with real transport protocolstacks, end-host mechanisms, network equipments and links.Given such realistic and long traces, we have been able todemonstrate experimentally, and with an accuracy still neverachieved with real data nor with simulations, that Taqqu’sTheorem and the relation between self-similarity and heavy-tailness actually holds. In particular, we obtained a significantagreement between theoretical and experimental values at thetransition points:α = 2. This is a particularly involvedcase, for it mixes difficulties of different kinds regardingtheestimation of bothH andα indices. Pursuing our empiricalcertification of Taqqu’s relation, we rigorously demonstratedthat when the distribution of the OFF periods has an heaviertail than that of flows’ size, it prevails at imposing longrange dependence to the aggregated traffic. As it is elegantlytackled in [38] and [39], we believe that a precise statisticalcharacterization of idle times is an important factor of trafficmodeling. In this direction, we are currently exploiting theflexibility of our original Grid5000 testbed to study how theresponse of protocol mechanisms to congestion creates newOFF periods, and how these latter do impact the self-similarityproperties of traffic.

Following up the controversial discussion about the relation-ship between transport protocols and self-similarity – raisedafter and despite Crovella et al.’s meaningful contributions[3] (see e.g. discussion in [12]) – our observations confirmthat in loss-free situations, protocols, bitrate mechanisms or

packet and flow-level controls do not impact the observed longrange dependence. Our analyses show that this is so, becausethe ranges of scales (segmented according to theRTT andto the mean flow duration) related to self-similarity are farcoarser than those (fine and medium scale) associated to suchmechanisms. As a natural sequel of the present work, we nowplan to confront these results to more actual situations involvedin real network applications. In particular, we will generatelong-term stationary traces under various congestion and ag-gregation levels, with heterogeneous source rates, involvingdifferent source protocols, mixing variableRTT s, includingseveral bottleneck and buffer capacities and ran with withvariants of the high speed transport protocols. A precise studyof the self-similarity impact on buffer utilization, queueingdelays and dynamics, would certainly be worth investigatingas well. In our opinion though, the present study builds thedefinitive support to get new insights on the relevance ofTaqqu’s relation regarding actual applications, and eventually,to help researchers design the future transport and networkcontrol protocols.

REFERENCES

[1] V. Paxson and S. Floyd, “Wide area traffic: The failure of Poissonmodeling,” in SIGCOMM, New York, NY, USA, 1994, pp. 257–268,ACM Press.

[2] W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson, “On theself-similar nature of ethernet traffic (extended version),” ACM/IEEETrans. on Net., vol. 2, no. 1, pp. 1–15, Feb. 1994.

[3] M. E. Crovella and A. Bestavros, “Self-similarity in World Wide Webtraffic: Evidence and possible causes,”IEEE/ACM Trans. on Net., vol.5, no. 6, pp. 835–846, Dec. 1997.

[4] T. Karagiannis, M. Molle, and M. Faloutsos, “Long-rangedependence -ten years of internet traffic modeling,”IEEE Internet Computing, Sept.2004.

[5] P. Abry, R. Baraniuk, P. Flandrin, R. Riedi, and D. Veitch, “Multiscalenetwork traffic analysis, modeling, and inference using wavelets, multi-fractals, and cascades,”IEEE Sig. Proc. Magazine, vol. 3, no. 19, pp.28–46, May 2002.

[6] P. Abry, P. Flandrin, M.S. Taqqu, and D. Veitch, “Wavelets for theanalysis, estimation and synthesis of scaling data,” inSelf-SimilarNetwork Traffic and Performance Evaluation, Kihong Park and WalterWillinger, Eds. 2000, John Wiley & Sons, Inc.

[7] M. S. Taqqu, W. Willinger, and R. Sherman, “Proof of a fundamentalresult in self-similar traffic modeling,”SIGCOMM CCR, vol. 27, no. 2,pp. 5–23, 1997.

[8] W. Willinger, M. S. Taqqu, R. Sherman, and D. V. Wilson, “Self-similarity through high-variability: statistical analysis of ethernet lantraffic at the source level,”IEEE/ACM Trans. on Net., vol. 5, no. 1,pp. 71–86, 1997.

[9] P. Doukhan, G. Oppenheim, and M.S. Taqqu,Long-Range Dependence:Theory and Applications, Birkhauser, Boston, 2003.

[10] L. Guo, M. Crovella, and I. Matta, “Corrections to ‘How does TCPgenerate pseudo-self-similarity?’,”SIGCOMM CCR, vol. 32, no. 2,2002.

[11] K. Park, G. Kim, and M. Crovella, “On the relationship betweenfile sizes, transport protocols, and self-similar network traffic,” in Int.Conf. on Network Protocols, Washington, DC, USA, 1996, p. 171, IEEEComputer Society.

[12] D. R. Figueiredo, B. Liu, A. Feldmann, V. Misra, D. Towsley, andW. Willinger, “On TCP and self-similar traffic,” Performance Eval-uation, vol. 61, no. 2-3, pp. 129–141, 2005.

[13] R. Bolze, F. Cappello, E. Caron, M. Dayde, F. Desprez, E. Jeannot,Y. Jegou, S. Lanteri, J. Leduc, N. Melab, G. Mornet, R. Namyst,P. Primet, B. Quetier, O. Richard, E.-G. Talbi, and I. Touche,“Grid’5000: a large scale and highly reconfigurable experimental gridtestbed.,”Int. J. of High Performance Computing Applications, vol. 20,no. 4, pp. 481–494, nov 2006.

[14] K. Park and W. Willinger,Self-Similar Network Traffic and PerformanceEvaluation, John Wiley & Sons, Inc., New York, NY, USA, 2000.

13

[15] P. Barford, J. Kline, D. Plonka, and A. Ron, “A signal analysisof network traffic anomalies,” inSIGCOMM Internet MeasurementWorkshop, Marseille, France, Nov. 2002.

[16] B. White, J. Lepreau, L. Stoller, R. Ricci, S. Guruprasad, M. Newbold,M. Hibler, C. Barb, and A. Joglekar, “An integrated experimentalenvironment for distributed systems and networks,”ACM SIGOPSOperating Systems Review, vol. 36, no. SI, pp. 255–270, 2002.

[17] D. G. Andersen, H. Balakrishnan, M. F. Kaashoek, and R. Morris,“Resilient overlay networks,” inProc. of the 18th ACM SOSP, Oct.2001.

[18] A. Bavier, M. Bowman, B. Chun, D. Culler, S. Karlin, L. Peterson,T. Roscoe, T. Spalink, and M. Wawrzoniak, “Operating systemsupportfor planetary-scale network services,” inProc. of the 1st Symposium onNetwork System Design and Implementation, Mar. 2004.

[19] A. B. Downey, “Evidence for long-tailed distributionsin the internet,”in SIGCOMM Internet Measurement Workshop, New York, NY, USA,2001, pp. 229–241, ACM Press.

[20] C. Barakat, P. Thiran, G. Iannaccone, C. Diot, and P. Owezarski, “Aflow-based model for internet backbone traffic,” inSIGCOMM InternetMeasurement Workshop, New York, NY, USA, 2002, pp. 35–47, ACMPress.

[21] N. Hohn, D. Veitch, and P. Abry, “Cluster processes, a natural languagefor network traffic,” IEEE Trans. on Sig. Proc. – Special Issue on Sig.Proc. in Net., vol. 8, no. 51, pp. 2229–2244, Oct. 2003.

[22] P. Abry, P. Goncalves, and P. Flandrin, “Wavelets, spectrum analysis and1/f processes,” inLecture Notes in Statistics: Wavelets and Statistics,A. Antoniadis and G. Oppenheim, Eds., 1995, vol. 103, pp. 15–29.

[23] S. Mallat, A Wavelet tour of signal processing, Academic Press, 1999.[24] R. J. Adler, R. E. Feldman, and M. S. Taqqu,A Practical Guide To

Heavy Tails, Chapman and Hall, New York, 1998.[25] J. H. McCulloch, “Measuring tail thickness to estimatethe stable index

alpha: A critique,” American Stat. Asso., vol. 15, pp. 74–81, 1997.[26] P. Goncalves and R. Riedi, “Diverging moments and parameter esti-

mation,” J. of American Stat. Asso., vol. 100, no. 472, pp. 1382–1393,December 2005.

[27] “Iperf, NLANR/DAST project,” http://dast.nlanr.net/Projects/Iperf/.[28] Y. Kodama, T. Kudoh, T. Takano, H. Sato, O. Tatebe, and S.Sekiguchi,

“GNET-1: Gigabit ethernet network testbed,” inProc. of the IEEE Int.Conf. Cluster 2004, San Diego, California, USA, Sept. 20-23 2003.

[29] “Ipsumdump,” http://www.cs.ucla.edu/∼kohler/ipsumdump/.[30] N. Duffield, C. Lund, and M. Thorup, “Estimating flow distributions

from sampled flow statistics,”IEEE/ACM Trans. on Net., vol. 13, no.5, pp. 933–946, October 2005.

[31] M. E. Crovella, M. S. Taqqu, and A. Bestavros, “Heavy-tailed proba-bility distributions in the World Wide Web,” inA Practical Guide ToHeavy Tails, Robert J. Adler, Raisa E. Feldman, and Murad S. Taqqu,Eds., chapter 1, pp. 3–26. Chapman and Hall, New York, 1998.

[32] S. I. Resnick, H. Dress, and L. De Haan, “How to make a hillplot,”OR & IE University, 1998.

[33] S. Soudan, R. Guillier, and P. Vicat-Blanc Primet, “End-host basedmechanisms for implementing flow scheduling in gridnetworks,” inGridNets 2007, Oct. 2007.

[34] “Iproute2, the linux foundation,” http://www.linux-foundation.org/en/Net:Iproute2/.

[35] R. Takano, T. Kudoh, Y. Kodama, M. Matsuda, H. Tezuka, andY. Ishikawa, “Design and evaluation of precise software pacing mech-anisms for fast long-distance networks,” inPFLDnet, Lyon, France,2005.

[36] “Hierachical token bucket packet scheduler,”http://luxik.cdi.cz/∼devik/qos/htb/.

[37] M. Roughan, J. Yates, and D. Veitch, “The mystery of the missingscales: Pitfalls in the use of fractal renewal processes to simulate LRDprocesses,” inASA-IMS Conf. on Applications of Heavy Tailed Distri-butions in Economics, Engineering and Statistics, American University,Washington, DC, June 1999.

[38] L. Guo, M. Crovella, and I. Matta, “How does TCP generatepseudo-self-similarity?,” in MASCOTS, Washington, DC, USA, 2001, p. 215,IEEE Computer Society.

[39] D. R. Figueiredo, B. Liu, V. Misra, and D. Towsley, “On the autocorre-lation structure of TCP traffic,”Computer Networks, vol. 40, no. 3, pp.339–361, 2002.

Patrick Loiseau was born in Paris, France, in 1982.He graduated fromEcole Normale Suprieure deLyon, France, in physics. He received the degree ofProfesseur-Agrege de Sciences-Physiques in 2005,and the M.S. degree of physics atENS Lyon, France,in 2006. Presently, he is pursuing a Ph. D. degree atthe computer science department of theENS Lyon,France. His main research interests include wavelet-based analysis and modeling of scaling phenomenain networks and grid traffic, with application to theQuality of Service. His is also interested in statistical

methods application to estimation problems.

Paulo Goncalvesgraduated from the Signal Pro-cessing Department of CPE Lyon, France in 1993.He received the M.S. and Ph.D. degrees in sig-nal processing from INPG, France, in 1990 and1993 respectively. While working toward his Ph.D.degree, he was with ENS Lyon. In 1994-96, hewas a Postdoctoral Fellow at Rice Univ., US. Since1996, he is associate researcher at INRIA, firstwith FRACTALES (1996-99), then withIS2 (2000-2003) and now with the team RESO at the ParallelComputing Lab. (LIP),ENS Lyon. From 2003 to

2005, he was on leave at IST Lisbon, Portugal.His research interests are in multiscale analysis and in wavelet-based

statistical inference. His principal application is in metrology and deals withgrid traffic statistical characterization and modelling for protocole qualityassessment and control.

Guillaume Dewaele was born in Hazebrouck,France, in 1978. He made his studies at theEcolenormale superieure de Lyon, France, receiving theProfesseur-Agrege de Sciences Physiques degree in2000, a Master in Physics in 2001 and defended aPh.D. degree in Numerical Simulation and ComputerVision in 2005. Since November 2005, he has been aAgrege Preparateur (Lecturer) with the Laboratoirede Physique,ENS Lyon. His research interests are insignal and image processing, numerical simulationsand internet traffic measurement and modeling, for

anomaly detection and identification purposes.

Pierre Borgnat was born in Poissy, France, in 1974.He made his studies at theEcole Normale Superieurede Lyon, France, receiving the Professeur-Agregede Sciences Physiques degree in 97, a Ms. Sc.in Physics in 99 and defended a Ph.D. degree inPhysics and Signal Processing in 2002. In 2003-2004, he spent one year in the Signal and ImageProcessing group of the IRS, IST (Lisbon, Portugal).Since October 2004, he has been a full-time CNRSresearcher with the Laboratoire de Physique,ENSLyon. His research interests are in statistical signal

processing of non-stationary processes (time-frequency representations, timedeformations, stationarity tests) and scaling phenomena (time-scale, wavelets)for complex systems (turbulence, networks,...). He is alsoworking on Internettraffic measurements and modeling, especially for securityenforcement basedon measurements.

14

Patrice Abry was born in Bourg-en-Bresse, Francein 1966. He is Professeur-Agrege de SciencesPhysiques (1989) and completed a Ph.D. in Physicsand Signal Processing in 1994. Since october 95,he is a permanent CNRS researcher, at the Labo-ratoire de Physique of Ecole Normale Superieurede Lyon. Patrice Abry received the AFCET-MESR-CNRS prize for best Ph.D. in Signal Processingfor the years 93-94 and is the author of a book“Ondelettes et Turbulences”, Diderot, 1997. Since2004, he is member of the SPS-SPTM committee.

His current research interests include the wavelet based analysis and modelingof scaling phenomena, of hydrodynamic turbulence and computer networkteletraffic.

Pascale Vicat-Blanc Primet is senior researcherat the National Institute of Research in ComputerScience (INRIA) since 2005. Since 2002, she isleading, the INRIA RESO team (22 researchers andengineers) within the LIP laboratory of theEcoleNormale Superieure de Lyon. Since beginning of2008, she also leads the “Semantic Networking”research team of INRIA-Bell Labs common labo-ratory. Her research interests include High Speedand High Performance Networks, Internet proto-cols design and architecture, Quality of Service,

network and traffic measurement, Network programmability and virtual-ization, Grid networking She is member of the scientifical committee ofGrid5000’s/ALADDIN - French Computer Science Grid initiative. She haspublished more than 80 papers in International Journal and Conferences inNetworking and Grid computing. She obtained her Habilitation Diriger lesRecherches from University of Lyon in 2002, her PhD (88) in ComputerScience, MsC (84) and Engineer diploma (84) in CS from INSA deLyon.